Christopher Mühl
04c2b06c14
Composite action for deploying Nix flake OCI images to Nomad. Owns the static-site parameterized Nomad job template, all infra defaults (registry, S3, Nomad addr), and an optional smoke test. Site repos only need to provide a flake with an ociImage output and pass domain + 3 secrets (S3_ACCESS_KEY, S3_SECRET_KEY, NIX_SIGNING_KEY). Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
97 lines
2.8 KiB
YAML
97 lines
2.8 KiB
YAML
name: Deploy OCI Site
|
|
description: Build a Nix flake OCI image, push to registry, and deploy via Nomad
|
|
|
|
inputs:
|
|
domain:
|
|
description: 'Domain the site is served at (e.g. toph.so)'
|
|
required: true
|
|
|
|
registry:
|
|
description: 'Container registry host'
|
|
required: false
|
|
default: 'registry.toph.so'
|
|
|
|
s3-endpoint:
|
|
description: 'S3 endpoint for the Nix binary cache'
|
|
required: false
|
|
default: 'https://s3.toph.so'
|
|
|
|
nomad-addr:
|
|
description: 'Nomad API address'
|
|
required: false
|
|
default: 'http://172.17.0.1:4646'
|
|
|
|
smoke-test:
|
|
description: 'Run a smoke test against the domain after deploy'
|
|
required: false
|
|
default: 'true'
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install tools
|
|
shell: bash
|
|
run: nix profile install nixpkgs#skopeo nixpkgs#nomad
|
|
|
|
- name: Build OCI image
|
|
shell: bash
|
|
run: nix build .#ociImage --out-link result-image
|
|
|
|
- name: Push image to registry
|
|
shell: bash
|
|
run: |
|
|
IMAGE_TAG=$(nix eval --raw .#packages.x86_64-linux.ociImage.imageTag)
|
|
skopeo copy \
|
|
docker-archive:./result-image \
|
|
docker://${{ inputs.registry }}/${{ inputs.domain }}:${IMAGE_TAG}
|
|
skopeo copy \
|
|
docker-archive:./result-image \
|
|
docker://${{ inputs.registry }}/${{ inputs.domain }}:latest
|
|
echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
|
|
|
|
- name: Sign and push Nix closure to cache
|
|
shell: bash
|
|
run: |
|
|
echo "${NIX_SIGNING_KEY}" > /tmp/nix-key
|
|
nix store sign -k /tmp/nix-key --recursive ./result-image
|
|
nix copy \
|
|
--to "s3://nix-cache?endpoint=${{ inputs.s3-endpoint }}&access-key-id=${S3_ACCESS_KEY}&secret-access-key=${S3_SECRET_KEY}" \
|
|
./result-image
|
|
rm /tmp/nix-key
|
|
env:
|
|
NIX_SIGNING_KEY: ${{ env.NIX_SIGNING_KEY }}
|
|
S3_ACCESS_KEY: ${{ env.S3_ACCESS_KEY }}
|
|
S3_SECRET_KEY: ${{ env.S3_SECRET_KEY }}
|
|
|
|
- name: Register Nomad job
|
|
shell: bash
|
|
run: |
|
|
nomad job run "${{ github.action_path }}/static-site.hcl"
|
|
env:
|
|
NOMAD_ADDR: ${{ inputs.nomad-addr }}
|
|
|
|
- name: Dispatch deployment
|
|
shell: bash
|
|
run: |
|
|
nomad job dispatch \
|
|
-meta "image_tag=${IMAGE_TAG}" \
|
|
-meta "domain=${{ inputs.domain }}" \
|
|
static-site
|
|
env:
|
|
NOMAD_ADDR: ${{ inputs.nomad-addr }}
|
|
|
|
- name: Smoke test
|
|
if: inputs.smoke-test == 'true'
|
|
shell: bash
|
|
run: |
|
|
echo "Waiting for deployment..."
|
|
for i in $(seq 1 12); do
|
|
if curl -sf --max-time 5 "https://${{ inputs.domain }}/" > /dev/null; then
|
|
echo "OK — https://${{ inputs.domain }}/ is up"
|
|
exit 0
|
|
fi
|
|
echo "Attempt ${i}/12 — retrying in 5s..."
|
|
sleep 5
|
|
done
|
|
echo "Smoke test failed: https://${{ inputs.domain }}/ did not respond"
|
|
exit 1
|